Juniper Junos CLI Setup: Treat Router Config Like a Pull Request

A new Juniper device is easier to configure if you think of it the way you think of a Git repository. You edit a working copy, review a diff, commit, and roll back if it goes wrong. Junos was built around that model, which is why a first-time setup feels different from a home router or a Cisco box.

The short version: connect to the console (9600 baud, 8 data bits, no parity, 1 stop bit, no flow control), log in as root with no password, set a root password, set a hostname and management address, then commit. Junos won't accept the first commit until root authentication exists. The same flow applies to MX, PTX and ACX routers, SRX firewalls, and EX and QFX switches, since they all run Junos OS.

The working copy and the running config

When you enter configuration mode, you edit a private candidate configuration. The device keeps running the active one until you commit. Cisco IOS, by contrast, applies each command to the running configuration as you type it.

The prompt tells you which mode you're in:

root@%      shell (type "cli" to leave it)
root>       operational mode: show, ping, request
root#       configuration mode: set, delete, commit

If set gives you a syntax error, you are almost certainly at the > prompt. Type configure first.

First boot, end to end

login: root
root@% cli
root> configure
[edit]
root# set system host-name lab-edge1
root# set system root-authentication plain-text-password
New password:
Retype new password:
root# set interfaces fxp0 unit 0 family inet address 192.168.50.10/24
root# set system backup-router 192.168.50.1
root# commit
commit complete

plain-text-password is a misleading name. Junos prompts for the password without echoing it and stores only a hash. Use encrypted-password if you generate hashes elsewhere, or an ssh-ed25519 key under the same statement.

The management interface name depends on the platform. MX and PTX routers usually use fxp0 or em0, EX and QFX switches use me0 or em0, and a vSRX uses fxp0. Branch SRX models vary, so check the hardware guide.

For remote access, create a named user, because Junos blocks root logins over SSH by default:

root# set system login user admin class super-user authentication plain-text-password
root# set system services ssh

Review the diff before you commit

show | compare is the equivalent of git diff. It shows what differs between the candidate and the active configuration:

root# show | compare
[edit system]
- host-name lab-edge1;
+ host-name lab-edge1-new;

root# commit check
configuration check succeeds

commit check validates the candidate without activating it. Then you have two ways to commit:

• commit activates the candidate immediately.
• commit confirmed 5 activates it, then rolls back automatically after 5 minutes unless you run commit again. Without a number, the timer is 10 minutes.

Use commit confirmed on any remote session. If a change to the management address cuts your connection, the device returns to the previous configuration by itself.

Rollback and history

Junos stores up to 50 committed configurations, numbered rollback 0 to rollback 49.

• rollback 0 discards uncommitted changes.
• rollback 1 loads the previous committed configuration into the candidate. You still have to run commit to activate it.
• commit comment <text> records a message with the commit, which works like a commit message.

Keep a text copy outside the device

If you want the configuration in version control, export it as set commands, one per line:

root@lab-edge1> show configuration | display set

Each line is a standalone set statement, so the output diffs cleanly in Git. You can also write a copy to the device itself:

root# save /var/tmp/lab-edge1-backup.conf

For a full backup of the system and /config to the alternate boot device, use request system snapshot. Run it only after the new configuration works, because it overwrites the backup copy.

One difference on SRX

On an SRX firewall, an interface answers no management sessions until it belongs to a security zone that permits the service:

root# set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ssh
root# set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ping

If an SRX interface is up but you can't reach it, check this first.

Verify

root@lab-edge1> show interfaces terse
root@lab-edge1> show route
root@lab-edge1> show system alarms

A healthy interface reads up in both the Admin and Link columns. In show route, inet.0 is the IPv4 unicast table, and a missing default route usually means the static route wasn't committed or its next hop is unreachable.

FAQ

What is the default Juniper login?
The username is root and the password is blank. Junos requires you to set root authentication before it accepts a commit on a device with no base configuration.

Why does my first commit fail?
There's no root password or key yet. Set one with set system root-authentication plain-text-password, then commit again.

How do I undo a committed change?
Run rollback 1, then commit. Or use commit confirmed so the device reverts on its own.

Can I use these commands on an EX switch or SRX?
Yes, because they all run Junos OS. Only interface names and SRX security zones differ.

For the full walkthrough, including a routing instance example, a troubleshooting table and a post-setup security checklist, see this step-by-step Junos CLI setup guide.

---

Published by Router IP Guide — Independent Hardware Networking & Gateway Diagnostic Suite.